Win32汇编实现判断进程是否拥有某特殊权限

来源：互联网发布：淘宝卖家打折设置编辑：程序博客网时间：2024/05/16 14:12

本文做为《Win32汇编实现提升进程Debug权限的两种方法》的姊妹篇发布，希望在需要的时候为大家提供参考。
(声明：魏滔序原创，转贴请注明出处。)

;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; Win32汇编实现判断进程是否拥有某特殊权限
; Programmed by 魏滔序
; WebSite: http://www.chenoe.com
; Blog: http://blog.csdn.net/Modest
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
    .486
    .model flat,stdcall
    option casemap:none
    include windows.inc

    include kernel32.inc
    include    Advapi32.inc

    includelib kernel32.lib
    includelib Advapi32.lib

.code
Start:

IsPrivilege PROC hProcess,dwPrivilege
    LOCAL hToken,BufferSize,i
    LOCAL tPrivilege:LUID_AND_ATTRIBUTES
    LOCAL pInfoBuffer,PrivilegeCount

    Invoke    OpenProcessToken,hProcess, TOKEN_QUERY, ADDR hToken
    .If    EAX == 0
        MOV    EAX,FALSE
        RET
    .EndIf

    Invoke    GetTokenInformation,hToken,TokenPrivileges, NULL, NULL, addr BufferSize
    .If    BufferSize == 0
        MOV    EAX,FALSE
        RET
    .EndIf

    MOV    EAX,BufferSize
    Invoke    GlobalAlloc,GMEM_FIXED,EAX
    MOV    pInfoBuffer,EAX

    Invoke    GetTokenInformation,hToken,TokenPrivileges, pInfoBuffer, BufferSize, addr BufferSize
    PUSH    EAX
    Invoke    CloseHandle,hToken
    POP    EAX

    .If    EAX == 0
        MOV    EAX,FALSE
        RET
    .EndIf

    MOV    i,0
    Invoke    RtlMoveMemory, addr PrivilegeCount,pInfoBuffer, 4
    .While    TRUE

        MOV    EAX,SIZEOF LUID_AND_ATTRIBUTES
        IMUL    EAX,i
        ADD    EAX,pInfoBuffer
        ADD    EAX,4
        Invoke    RtlMoveMemory, addr tPrivilege,EAX, SIZEOF LUID_AND_ATTRIBUTES
        MOV    EAX,dwPrivilege
        .IF    tPrivilege.Attributes != 0 && tPrivilege.Luid.LowPart == EAX
            MOV    EAX,TRUE
            RET
        .EndIf

        ADD    i,1
        MOV    EAX,i
        .Break .IF  EAX==PrivilegeCount
    .EndW

    MOV    EAX,FALSE
    RET
IsPrivilege Endp
End    Start